Ñusta Nina

Dutch DPA gets off its' ass, Fine of 600,000 euros for tracking cookies on Kruidvat.nl - detected in 2020 - The Dutch Data Protection Authority (AP) has imposed a fine of 600,000 euros on the company behind the Kruidvat drugstore. Kruidvat.nl followed consumers with tracking cookies, without their knowledge or permission. AS Watson collected and used sensitive personal data from millions of website visitors against the rules. The company behind Kruidvat collected data from website visitors and was able to create personal profiles. In addition to visitors' location data, this included which pages they visited, which products they added to the shopping cart and purchased and which recommendations they clicked on. That is very sensitive information, AP points out, due to the specific nature of drugstore products. Such as pregnancy tests, contraceptives or medication for all kinds of ailments. That sensitive information, linked to the location (which may be traceable via the IP address) of the unique visitor, can sketch a very specific and invasive profile of the people who visit Kruidvat.nl. Kruidvat.nl should have asked permission to place tracking cookies on visitors' computers. The GDPR privacy law sets a number of requirements for valid consent. These requirements are that consent must be given freely, for specific processing of personal data, on the basis of sufficient information and that there must be no doubt that consent has been given. In the cookie banner on Kruidvat.nl, the boxes to agree to the installation of tracking software were checked by default. That's not allowed. Visitors who still wanted to refuse the cookies had to go through many steps to achieve this. The AP has found that personal data of website visitors to Kruidvat.nl have been processed unlawfully. At the end of 2019, the AP started an investigation into various websites, including Kruidvat.nl. The AP tested whether these websites met the requirements for placing (tracking) cookies. The AP checked whether permission for tracking cookies was asked from website visitors and, if so, how exactly this happened. Kruidvat.nl was found not to comply in April 2020, after which the AP sent the company a letter. In 2020, the AP found that Kruidvat.nl was still not in order. The AP then started investigating this website further. This violation ended in October 2020. There is increasing social irritation about cookies and cookie notifications, ranging from annoying and misleading banners to concerns about the secret tracking of internet users. In 2024, the AP will check more often whether websites correctly request permission for tracking cookies or other tracking software. Source: Boete van 600.000 euro voor tracking cookies op Kruidvat.nl - Emerce - https://lnkd.in/dRd6ZUu5

2

We have good news and bad news. Good news are, we are returning with Joost's Case Corner, so expect lots of CJEU goodness from this episode. Bad news are, we get pretty distracted by other (equally important) topics before actually getting to the CJEU privacy cases… But don’t worry, whatever recent case law we didn’t cover in this episode, we’ll come back to in another episode in a few weeks! Ok, so what do we discuss in this episode? We had to start with EDPB’s Pay or Consent Opinion, as that is the most exciting piece of news from last week. Related to that, we also dare to talk about the Advocate General’s Opinion in the C-446/21 Schrems v Facebook case - even though the AG Opinion was only published after we recorded the episode. The CJEU cases we cover in this episode are: CJEU Belgian State – Data processed by an official journal [C-231/22] CJEU Gesamtverband Autoteile-Handel [C-319/22] CJEU FT – Copies of medical records [C-307/22] CJEU Ministerstvo zdravotnictví – COVID-19 mobile application [C-659/22] (Upcoming on 7 May 2024) - CJEU NADA and Others [C-115/22] #PrivacyPod #TietosuojaPod #Tietosuoja #GDPR #CaseCorner

14

4 commentaren

Is your DPO overworked? Do certain requests from authorities fall through the cracks? You could be in breach of the #GDPR, says the Belgian DPA in its newest decision. In this particular case, a DPO was working three days per week, and was the only person to have access to a particular e-mail address to which requests had been sent by the Belgian DPA. Among many other criticisms (the decision is actually about failure to erase data & take into account an objection to direct marketing), the Belgian DPA looks at whose responsibility it is: Para 83: "the Litigation Chamber emphasises the fact that the defendant  is obliged to cooperate with all the services of the DPA. Failure to respond to a letter sent by one of the Belgian DPA's departments, in this case an invitation to cooperate in a mediation by the First-Line Service, could be interpreted as a refusal to cooperate and potentially be considered a breach of Article 31 of the GDPR." Para 84: "The Litigation Chamber observes that the defendant attempts to avoid liability by attributing the negligence of not responding to communications from the First-Line Service, the Inspection Service, the Litigation Chamber and the complainant to its former DPO. The defendant maintains that it was not aware of the excessive workload of the latter, which would have hindered its ability to respond favourably to the requests of the Belgian DPA and the plaintiff. [...] If the controller appoints a DPO for its legal department or uses a generic e-mail address such as ‘privacy@Y.be’ to respond to requests from data subjects, it is the controller's responsibility to ensure that e-mails sent to this address are regularly consulted and processed, even if a person who has worked in the department in question and/or the DPO resigns, or if the DPO's workload becomes excessive. On this last point, the Litigation Chamber would point out that it is up to the data controller to comply with the provisions of article 38 of the GDPR." Conclusion here? A fine (about 170k EUR, reduced after taking economic circumstances of the company into account) Decision (in French): https://lnkd.in/espPSvs5 #dataprotection #privacy

110

6 commentaren

🤖Interesting EDPS - European Data Protection Supervisor Guidelines on GenAI...and my personal highlight😆 This document aims to help EUIs to comply with EUDPR - useful anyway for the private sector as well. Personal fav: "When a developer or a provider of a generative AI system claims that their system does not process personal data (for reasons such as the alleged use of anonymised datasets or synthetic data during its design, development and testing), it is crucial to ask about the specific controls that have been put in place to guarantee this."

39

1 commentaar

Curious how NOVAPLEX can help streamline your law firm's or in house legal team's document production processes? Join Thomas and Stefan for a live webinar (will also be available on demand) on Tuesday 18 June, 08:15-09:00 CET. Link to registration in the comments. #LegalTech #Compare #Transform #PDFtools #DocumentAutomation #DocumentDrafting #DocumentProduction #LegalDesign #LegalInnovation

19

3 commentaren

🔍 Insights on Privacy Protection: New AP Guidelines on Scraping Activities The new guidelines on scraping issued by the Dutch Data Protection Authority (AP) is a significant step in protecting individuals' privacy rights in the digital age. Scraping, the automated collection and storage of information from the internet, has become increasingly prevalent, raising concerns about the unauthorized use of personal data and potential privacy risks.💡 The guidelines provide much-needed clarity on the legal framework surrounding scraping activities conducted by private parties and individuals. By emphasizing that scraping is almost always illegal and can constitute a violation of the GDPR, the AP underscores the importance of respecting individuals' privacy rights and ensuring compliance with data protection laws.🛡️ One key aspect highlighted in the guidelines is the requirement for a legal basis to justify scraping activities. While scraping may be permissible in exceptional cases, such as for domestic use or when conducted with explicit consent, it must adhere to strict conditions outlined in the GDPR. This includes ensuring that scraping is not solely aimed at commercial gain and that appropriate safeguards are in place to protect individuals' personal data. Furthermore, the guidelines debunk the misconception that information freely available on the internet can be scraped without consent. The AP rightly emphasizes that public availability does not equate to consent, and individuals have the right to control how their personal data is collected and used.🔒 Overall, the guidelines on scraping by the AP serve as a valuable resource for organizations and individuals engaging in online data collection activities. By promoting transparency, accountability, and respect for privacy rights, these guidelines contribute to building trust in the digital ecosystem and safeguarding individuals' fundamental right to privacy. https://lnkd.in/dftzncJf

10

Is your Privacy at risk? EU’s New Legislation Could End Encrypted Chats! The EU Council's vote on the controversial chat control legislation, aimed at combating child sexual abuse material (CSAM), has been delayed due to privacy concerns. The draft law proposes client-side scanning, which would force apps like WhatsApp and Signal to build backdoors, effectively undermining encryption and chilling free speech. Key Points: 🍁Legislation Impact : The CSAM bill could end secure, encrypted communication by scanning messages on users' devices, bypassing encryption. 🍁Privacy Concerns: Critics, including child protection experts, privacy advocates, and academics, warn that the system would compromise privacy and freedom of speech. 🍁Opposition: Countries like Germany, Austria, Poland, the Netherlands, and the Czech Republic are expected to oppose the law. 🍁Potential Shifts: Reports suggest France might change its stance, breaking the current opposition. 🍁Signal's Stance: Signal's president, Meredith Whittaker, stated that mass scanning undermines encryption and threatened to exit the EU market if the law passes. The CSAM bill is a significant piece of legislation that could reshape the future of digital privacy in the EU. So far ,EU is setting the standards for Privacy regulations across the world, what if they passed this bill? What are your thoughts on the CSAM bill and its impact on encrypted communications? #DataPrivacy #Encryption #EUlegislation #CSAMbill #OnlineSecurity #PrivacyMatters #DigitalRights #TechNews #FreeSpeech

11

1 commentaar

The Dutch Data Protection Authority issued a Discussion Paper named "Supervisory Perspective on Global AI Governance" In response to the interim report of the UN SG’s AI Advisory Body, this brief discussion paper outlines how national and regional AI supervisors should be involved in the global AI governance framework. This brief discussion paper outlines how national and regional AI supervisors should be involved in the global AI governance framework, The paper was written in conjunction with the interim report of the UN SG's AI Advisory Body. They advocate the establishment of a global AI institution that facilitates risk monitoring, standard setting, knowledge exchange, and peer review on the international level. #privacy #ai #governance 

16

Copyright compliance and a sustainable creative and publishing sector go hand in hand: love and marriage, horse and carriage🇧🇪⚠️©️

11

Did you know that most web scraping activities are unlawful under the GDPR? The Dutch DPA recently clarified the strict limitations on scraping data from the internet, emphasizing privacy concerns and legal boundaries. Curious to learn more? 👉 Read the full blog on our website to understand the dos and don’ts of web scraping; https://lnkd.in/emh2awyE #webscraping #gdpr #aphaia #privacy

3

🤖🔍 #AIAct enforcement. The Autoriteit Persoonsgegevens (Dutch DPA) and the National Digital Infrastructure Inspectorate (RDI) released advice on creating the national institutional structure for AI Act enforcement. 🟣The AI Act mandates establishing a national structure to ensure compliance, and the Dutch DPA suggests delegating supervisory roles to the most relevant sector or domain-specific supervisors. The supervisory authority also recommends maintaining broad oversight in collaboration with these specific supervisors. Key recommendations include: 📍It’s crucial to align the new supervisory roles with existing ones. Not all sector-specific supervisors can handle market supervision tasks without significant changes to their mandates. Therefore, a system where market supervisory authorities and sector-specific supervisors work closely is proposed. This collaboration is essential for effective risk management and requires further detailed planning. 📍Effective supervision requires adequate resources and capacity. Any new tasks for supervisors must be matched with sufficient funding and support. This includes training and enhancing AI literacy among AI system operators and society. 📍The advice suggests assigning the coordination of sandbox activities to the RDI and the Dutch DPA. These sandboxes will allow testing and developing AI systems in a controlled environment, fostering innovation while ensuring compliance with the AI Act. 📍 Designating market supervisory authorities for prohibited AI systems is urgent. The Dutch DPA should oversee the enforcement of all prohibitions in Article 5 of the AI Act, including biometric identification and predictive policing. 📍The AI Act emphasises the role of fundamental rights supervisors. These supervisors will need resources and a robust cooperation structure to evaluate AI systems effectively. #privacy #ai

43

2 commentaren

New research from Privacy Company for SURF and SIVON shows that the Dutch education sector can (continue) to use Google Workspace for Education, if schools and universities take the recommended measures.   Google has taken the agreed measures to mitigate the known high data protection risks.   Read the full article about the research by Sjoera Nas and Floor Terra here: https://lnkd.in/ePFXPcTp #privacy #education #gdpr   Make the world more privacy friendly. That's our mission. Follow Privacy Company.

26

🔔 Our highly anticipated webinar on AI Training and Legal Basis is just around the corner, and we are thrilled to introduce our esteemed panel of speakers! 📅 The Date: 6 June, 2024 🎤 Confirmed Speakers: Hielke Hijmans - Director at the Belgian DPA Erevan Malroux - Legal Expert in the AI team at CNIL Pablo Trigo Kramcsák - Team member BPH and Ph.D. Researcher at VUB 🔍 Webinar Topic: AI Training and Legal Basis: To Segment or Not to Segment Training and Deployment Phases? Delve into the intricate legalities of AI model development with us. Can AI developers process personal data under GDPR Article 6? We'll analyze the 2022 Clearview Decision by CNIL and recent AI guidelines to determine the impact of segmenting training and deployment phases on GDPR compliance. 📢 Don't miss out! Register now for free using the link below. https://lnkd.in/dZYSkwtF

16

When clients ask: can we scrape personal information of individuals in the EU for our business the "no"s (consent as legal basis is hard) are generally clear and the "yes"es - more complex Netherlands Autoriteit Persoonsgegevens (Dutch DPA) guidelines on scraping provides some clarity. 🔹 If personal data is scraped - GDPR is in scope. (US: not always the case because the data may be public and out of scope of privacy laws). 🔹 GDPR governs your scraping if you are in scope for GDPR (offer products or services to individuals in the EU or monitor the behavior of individuals in the EU). 🔹 For monitoring - the issue is whether or not the scraping is done to collect information about the behavior of people in the EU, e.g. for personalization - if so - GDPR applies. 🔹 Scraping for the purpose of training an algorithm that allows users outside of the EU to generate images of computer code, would NOT constitute monitoring and does not trigger GDPR. 🔹 You can apply a geographic filter to the scraping to exclude EU domains in order to not be in scope for GDPR; applying the filter to the processing (after the scraping has been done) - is not enough. If GDPR applies - you have to abide by all requirements - including transparency, data minimization and accuracy of the data - all difficult to achieve with scraping. You also need a legal basis: 🔹 Scraping from the internet is NOT compatible further processing and you need a new legal basis 🔹 For private companies - the only potential viable legal basis is legitimate interest (because consent is generally not practical/feasible). 🔹 Posting of data on the Internet by those visible to everyone can be seen as permission to view the data. But not as permission to subsequently scrape the data or process it otherwise (e.g. derive biometrics from a photo) (this may render the data "public" and out of scope in the US; but some laws/bills provide an exception for sensitive data) 🔹 Legitimate interest: Per AP - a mere commercial interest is not sufficient for legitimate interest legal basis (but this is up for discussion by the CJEU). Balance of the interests (not outweighed by rights): consider: 🔹 Whether the scraped results are searchable for profiles (more risky); 🔹 Whether there is sensitive data involved [if you can't exclude the possibility - need a special condition for processing 🔹 Expectations: how far is the use that you will be making with the scraped data from what the data was put up there in the first place. 🔹 Potential consequences for those whose data was scraped? If scraping for the purpose of training an algorithm - also consider; 🔹 other laws that apply 🔹 accuracy 🔹 discrimination/bias To do: 🔹 DPIA to assess the risks 🔹 Detailed disclosure 🔹 Allow deletion 🔹 Delete/ anonymize the data ASAP; 🔹 Comply with Internet standards (robots.txt) #dataprivacy #dataprotection #privacyFOMO #AIFOMO pic by vectorjuice for freepik https://rb.gy/0ac05e

108

8 commentaren

Dutch DPA tackles algorithmic discrimination The scandal of 2023 highlighted a serious issue of algorithmic discrimination within government organizations in the Netherlands. In response to these challenges, the Data Protection Authority (AP) became the coordinating supervisor for algorithms and artificial intelligence starting January 2023. AP's collaboration with the European Data Protection Board (EDPB) is crucial for effective oversight, especially concerning major tech companies like TikTok. However, issues arise due to the hiring of private investigative firms to address confidentiality matters, leading to duplication and inefficiency. Increasing AP's budget is recommended to enhance oversight and protect personal data rights more effectively. This will enable a more robust fight against algorithmic discrimination and underscores the importance of regulatory bodies like AP in safeguarding citizens' rights in the digital age. Fighting algorithmic discrimination is key to protecting our rights in the digital world! Source: https://lnkd.in/exGAVZPE #algorythm #Holland #discrimination #EDRB #digitalspace #avitar #data_protection

8

EDPB launches French and German versions of its Data Protection Guide for small business: The EDPB Data Protection Guide for small business is now available in French and German The Guide provides practical information to SMEs about GDPR compliance and benefits in an accessible and easily understandable language. The development of tools providing practical, easily understandable and accessible data protection guidance is key to reaching a non-expert audience and a strategic objective for the EDPB. The EDPB Data Protection Guide for small business covers various aspects of the GDPR, from data protection basics, to data subject rights and measures to secure personal data. It contains videos, infographics, interactive flowcharts, and other practical materials to help SMEs on their way to become GDPR compliant In the near future, the Guide will become available in 15 more European languages. #dataprotection #dataprivacy #privacy

2

“Welcome! Welcome! Welcome! To PrivacyPod Joost’s Case Corner Episode, we are your hosts Milla Keller and Pilvi Alopaeus with Joost Kle… Gerritsen. Thank you so much for joining us and let us begin with our first and most important story, the events of last week’s Eurovision and the big denim egg that made it all the way to “Last Week Tonight” with John Oliver (Go Finland!).” After we have gathered ourselves from the too short (Panu’s comment which has been noted) section on Eurovision, we move head first to the most interesting recent CJEU cases! And what is on the chopping block today? - CJEU NADA and Others [C-115/22], where doping results were published online. - CJEU Juris [C-741/21], where a lawyer wanted to be compensated on receiving direct marketing which for some reason made some of our hosts just lose it (sorry). - CJEU IAB Europe [C-604/22], where our focus is on the joint controllership aspect of the case. "Thank you so much for listening and good night!" #privacypod #privacy #dataprotection #tietosuoja #GDPR #JoostCaseCorner #Sillyhosts #sorry #DenimEgg #Windows95Man

13

7 commentaren

The AI Act is law! After a long journey (I already wrote a thesis about the first Commission proposal back in 2021), the final text of the AI Act was published in the Official Journal of the EU today. It will enter into force in 20 days, on 2nd of August, starting a long period of transition. The first milestone will be the applicability of article 5, the prohibited practices. And don't forget article 4, AI literacy! Interested to see which obligations are applicable when? ICTRecht made a handy roadmap (in Dutch). https://lnkd.in/e4nzJwNU

13